build-all

roles/init copy/files/id_rsa.pub

@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCjPi74gAHT2GBbKWWmmUrzzrhKQN3mnz3DTWn02KhbgWs6MRLlTrn2fLqB4hkoVEOat29wAOJ2xuY4aEjGfO6nl/3ka3oqslwxW9GqFCRXVHnF3b+Wly+jkn3tbht+gjFK4x0np1WZbpTI/nR7gElWa774LCHy5i4fm5ISoCHzRMsKd3dVF4YOte6QC9Uu4uQQjpZWksYRjANtXAk5EDEOERz+Dh8RDkXbGYW2vx1ihNQGh53z3c6W6bajGq3qx/+G905MtRgutbHWOOYSE8o2q3vaDkCNA6Fjd3P6gHTPcRjFEfoHc8Vxp0vjR9e6ol8X7D+GEL6g6QN656772Zo3/Qka0rJ/zMnT3gZ2S4i0CzmqDoecbzDCX7ywwuwgvlmJGOswgwwOKP/E0/RnWi63BUFV/fU9o5nr9ZXgkiRa9ZCzubHZhxyN6Z7EhcOVnMbvfV1W5Fn/vbj84YudCLmzrk5qvpQ+qVsMXi1GPIEyFwyg/Afu5JTpNE5+4ViFzTM= jd@morefine

roles/init copy/tasks/main.yml

@@ -0,0 +1,80 @@
+- name: Init
+  become: "{{ 'no' if inventory_hostname in ['sectorq.cloud', 'nas.home.lan'] else 'yes' }}"
+  block:
+    
+    - name: Include vault
+      ansible.builtin.include_vars:
+        file: init.yml
+    - name: Change password for jd
+      ansible.builtin.user:
+        name: jd
+        password: "{{ jd_password | password_hash('sha512') }}"
+    - name: "Ensure sudo binary  exist"
+      stat:
+        path: /usr/bin/sudo
+      register: sudo_binary
+    - name: "Install sudo if not present"
+      package:
+        name: sudo
+        state: present
+      when: not sudo_binary.stat.exists
+    
+    - name: Check if group exists
+      getent:
+        database: group
+        key: sudo
+      register: group_check
+      ignore_errors: true
+      
+    - name: Ensure deploy user exists
+      ansible.builtin.user:
+        name: jd
+        shell: /bin/bash
+        groups: sudo
+        append: true
+      when: group_check is succeeded
+    - name: Ensure directory sudoers.d exists
+      file:
+        path: /etc/sudoers.d
+        state: directory
+        owner: root
+        group: root
+        mode: '0755'
+  
+    - name: Give jd passwordless sudo
+      copy:
+        dest: /etc/sudoers.d/jd
+        content: "jd ALL=(ALL) NOPASSWD:ALL\n"
+        owner: root
+        group: root
+        mode: '0440'
+
+    - name: Change password for root
+      ansible.builtin.user:
+        name: root
+        password: "{{ jd_password | password_hash('sha512') }}"
+
+    - name: Update become password for subsequent tasks
+      ansible.builtin.set_fact:
+        ansible_become_password: "{{ jd_password }}"
+
+    - name: Add authorized SSH key
+      ansible.posix.authorized_key:
+        user: "jd"
+        key: "{{ lookup('file', 'id_rsa.pub') }}"
+        state: present
+
+    - name: Set timezone to Europe/Bratislava
+      ansible.builtin.command:
+        cmd: timedatectl set-timezone Europe/Bratislava
+      args:
+        creates: /etc/timezone
+    - name: Set hostname
+      ansible.builtin.hostname:
+        name: "{{ inventory_hostname }}"
+    - name: Add host entry to /etc/hosts
+      ansible.builtin.lineinfile:
+        path: /etc/hosts
+        regexp: "^127.0.0.1 .*"
+        line: "127.0.0.1 {{ inventory_hostname }} {{ inventory_hostname.split('.')[0] }}"
+        state: present

roles/init copy/vars/main.yml

@@ -0,0 +1,4 @@
+username: "jd"
+user_password: "{{ 'l4c1j4yd33Du5lo' | password_hash('sha512') }}"
+new_root_password: "{{ 'l4c1j4yd33Du5lo' | password_hash('sha512') }}"
+user_groups: "sudo"

roles/init/handlers/main.yml

@@ -0,0 +1,4 @@
+- name: Restart sshd
+  ansible.builtin.service:
+    name: sshd
+    state: restarted

roles/ssh_config copy/files/config

@@ -0,0 +1,26 @@
+Host m-server
+  HostName m-server.home.lan
+ 
+Host rpi5
+  HostName rpi5.home.lan
+
+Host rack
+  HostName rack.home.lan
+
+Host amd
+  HostName amd.home.lan
+  
+Host nas
+  HostName nas.home.lan
+  User admin
+
+Host router
+  HostName router.home.lan
+  User root
+Host external
+  HostName 193.168.144.164
+  User root
+Host *
+    User jd
+    IdentityFile ~/.ssh/id_rsa
+    StrictHostKeyChecking no

roles/ssh_config copy/tasks/main.yml

@@ -0,0 +1,22 @@
+- name: SSH config Setup
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  block:
+    - name: Include vault
+      ansible.builtin.include_vars:
+        file: jaydee.yml
+    - name: Upload config
+      ansible.builtin.copy:
+        src: config
+        dest: /home/jd/.ssh/config
+        mode: '0600'
+        owner: jd
+        group: jd
+      when: inventory_hostname != 'nas.home.lan'
+    - name: Upload config
+      ansible.builtin.copy:
+        src: config
+        dest: /root/.ssh/config
+        mode: '0600'
+        owner: root
+        group: root
+      when: inventory_hostname != 'nas.home.lan'

roles/ssh_config copy/vars/main.yml

@@ -0,0 +1 @@
+dest_folder: "/tmp/ans_repo"